Splunk Search

Does the time range picker apply the same range to both a primary search and subsearch? If yes, can I override the subsearch time range?

oraclebox
Explorer

I want to know about the scope of time range chosen by time range picker/
In my case, I have two sourcetypes and all data under these sourcetypes as shown below. If I choose last 24 hr in the time range picker, does it mean the range will apply to both the primay search and the join subsearch? In other words, will events returned by both searches include all events within the time range?

  search sourcetype=A xxxx
 | join [search sourcetype=B XXXX]

Also, if the time-range applies to both searches, can I override the time-range in the subsearch?

1 Solution

somesoni2
Revered Legend

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

View solution in original post

somesoni2
Revered Legend

You should be able to override the time range picker's time-range by using time modifiers (e.g. earliest, latest etc, see here for full list http://docs.splunk.com/Documentation/Splunk/6.1.4/SearchReference/SearchTimeModifiers). This holds true for both base search and subsearch.

So, I could use yesterday's data in base search and day before yesterday's data in subsearch, even though time range picker is set to yesterday.

index=_internal | stats count as yesterday by sourcetype | appendcols [search index=_internal earliest=-2d@d latest=-1d@d | stats count as dayB4yesterday by sourcetype]

oraclebox
Explorer

Thanks fro your reply. I am more clear.

0 Karma

somesoni2
Revered Legend

Here you go 🙂

0 Karma

triest
Communicator

@somesoni2 Could you post your comment as answer, so it can be accepted and then the question will be listed as having an answer.

Thanks!

jrodman
Splunk Employee
Splunk Employee

I believe the time picker time range applies to the primary search as well as to the subsearch. I do not know if in-search expressions like 'earliest' will work inside the subsearch.

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...